CVE-2026-107836

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107836
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107836.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107836
Aliases
  • GHSA-x924-p5fq-26pc
Published
2026-10-09T17:49:41Z
Modified
2026-10-11T07:04:31Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size
Details

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-191"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107836.json"
}
References

Affected packages

Git / github.com/riot-os/riot

Affected ranges

Type
GIT
Repo
https://github.com/riot-os/riot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
49b894cbe091510093273b98d92c4a17167d6839
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2026.07"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2013.*
2013.08
2014.*
2014.01
2014.05
2014.12
2015.*
2015.09-RC1
2015.12-RC1
2015.12-devel
2016.*
2016.03-devel
2016.04-RC1
2016.07-RC1
2016.07-RC2
2016.07-devel
2016.10-RC1
2016.10-devel
2017.*
2017.01-RC1
2017.01-devel
2017.04-RC1
2017.04-devel
2017.07-RC1
2017.07-devel
2017.10-RC1
2017.10-devel
2018.*
2018.01-RC1
2018.01-devel
2018.04-RC1
2018.04-devel
2018.07-RC1
2018.07-devel
2018.10-RC1
2018.10-devel
2019.*
2019.01-RC1
2019.01-devel
2019.04-RC1
2019.04-devel
2019.07-RC1
2019.07-devel
2019.10-RC1
2019.10-devel
2020.*
2020.01-RC1
2020.01-devel
2020.04-RC1
2020.04-devel
2020.07-RC1
2020.07-devel
2020.10-RC1
2020.10-devel
2021.*
2021.01-RC1
2021.01-devel
2021.04-RC1
2021.04-devel
2021.07-RC1
2021.07-devel
2021.10-RC1
2021.10-devel
2022.*
2022.01-RC1
2022.01-devel
2022.04-RC1
2022.04-devel
2022.07-RC1
2022.07-devel
2022.10-RC1
2022.10-devel
2023.*
2023.01-RC1
2023.01-devel
2023.04-RC1
2023.04-devel
2023.07-RC1
2023.07-devel
2023.10-RC1
2023.10-devel
2024.*
2024.01-RC1
2024.01-devel
2024.04
2024.04-RC1
2024.04-devel
2024.07-RC1
2024.07-devel
2024.10-RC1
2024.10-devel
2025.*
2025.01-RC1
2025.01-devel
2025.04-RC1
2025.04-devel
2025.07-RC1
2025.07-devel
2025.10-RC1
2025.10-devel
2026.*
2026.01-RC1
2026.01-devel
2026.04-RC1
2026.04-devel
2026.07-RC1
2026.07-devel
2026.10-devel

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107836.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "76832064733234223193889783773101696529",
            "length": 672
        },
        "id": "CVE-2026-107836-13fe178f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "_fetch_block"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "255707098787864809096830836544856557948",
            "length": 787
        },
        "id": "CVE-2026-107836-29727bd6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "_sock_put_post"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149845049140918104330384932862143665317",
            "length": 719
        },
        "id": "CVE-2026-107836-2d52f4be",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "nanocoap_sock_get_blockwise"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "107060447268449598051203092730318965964",
            "length": 671
        },
        "id": "CVE-2026-107836-4e9e0ff6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "_2buf_slice"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "169307500721701795328167298831746478115",
                "295813158917240658445462817112507531306",
                "70288771015992134253538214855103023065",
                "256501501910729510956192158878798513528",
                "290987677943873628050217538758500080365",
                "146464223189677111633665925912530068787",
                "220630893023653420725311973201143020555",
                "174025352075009688741592005007649379555",
                "129846494621987890911962146877569562995",
                "65578302141134160275502275780075088421",
                "246122926145765156370627238266871215039",
                "29467998943012179824531010738466108886",
                "185702398328951276323667114973314182927",
                "314008236201920016900435549384158847954",
                "147988792297222117436602425349423514192",
                "135468080122925054154753380586208758586",
                "164481126637224253901722643311673212430",
                "28843870287703352007323832771819314855",
                "98255939287550298175350561578881052433",
                "200589526362494021811525883746822272587",
                "72210402405461877696331843357600195898",
                "150536774297523689623693991939340239948",
                "115423411495203227984565374759383591465",
                "95222390496266571061662931039789667857",
                "57804281429765240967896370874107983054",
                "113613595562391133147105732986185828453",
                "322284466354888577704557657927196194955",
                "18781658228984464448702699001656964983",
                "156597293347297530133196289645339958288",
                "260169711633259319629583815711142948090",
                "242608183247151291059601793571167979787",
                "60626535628462523899435919968986402837",
                "338682449116260469039519694793437800352",
                "127292745121795461261084280665605374553",
                "132388207646262627170634496609993988475",
                "232409775669185390970236848950048828780",
                "147335555943979592833837574655334462380",
                "5089442158679376519720253578641146923",
                "242821038516716124431405340289035681501",
                "79499618660302000015165511457450026026",
                "23636894043270507664130809120541539787",
                "323430006121972890116731670258801727554",
                "229326906349322318734711603410967798096",
                "234819603444859403141878035844713406239",
                "125272147372771691877914159237048314333",
                "334223952400737275889289111834476543880",
                "227530151032414813527836431143583976431",
                "57793687832104706673244646403175100382",
                "303759081711761690989103555005828269868",
                "334932541731437577474444178714354017369",
                "51873931305736818689011146776790997016",
                "5530409680382448874441778104088658951",
                "158606965819553659988828297129399537977",
                "39485832915025538572737586149668147192",
                "190196350811436578764017375214193548242",
                "171154620143817178597344822263554734941",
                "128274118073857619592390786964730451938",
                "143391578266497546863458293123842537238",
                "182438523868276184021416270543498717715",
                "53889555703544458596860605247743870326",
                "167295998055282435918198225905340355709",
                "317039130943411275819438502804587418224",
                "208232089401901849257744667454295624337",
                "118906997162566598531539434225608172568",
                "254195116676599755927907214719986446950",
                "143388747882243604857828002525856070437",
                "245069331536060554941358180978912803745",
                "69252600006432688474143489084673510696",
                "138382779464015936532712017456877092397",
                "325990180184709158870760939198345034772",
                "310201233606007586335520475463029470102",
                "153754813680607111801991983552109288173",
                "227248631653825647728541685210775803313",
                "87134079801186655041343067124061669370",
                "73235295809668203741569863984323531473",
                "242982669542774924485398390887367112797",
                "304711255625486478861655066895156115884",
                "227979108173449540504595999446761383996",
                "315989031401831377941639943149703197280",
                "141463475992836853175353024763485156010",
                "149422235227181097113648563326858547272",
                "48552288184317023787715308594143955650",
                "271746089092457117253499979009439092210",
                "279748349831216791419710037904065116872",
                "310467125742481114144168920990057928044",
                "63957061269164737383151169185630894833",
                "143755424129503886478981935253263813710",
                "325532602970920509124608446643977457649",
                "206479150142858281693472167105917696289",
                "120659994793730298859289623935122174574",
                "135296685360721423352428486092986047790",
                "193923486222099153191013862170784074385",
                "143693328639123020046371474773011904972",
                "298327140482529955835602169681131290949",
                "102745491324833659592118464552874349098",
                "158606965819553659988828297129399537977",
                "293887006632446462021732543381189835875",
                "331450156502215059271840217126742280945",
                "111810843589874174062346952241837809158",
                "112893554872358120537350086012865230761",
                "128274118073857619592390786964730451938",
                "143391578266497546863458293123842537238",
                "182438523868276184021416270543498717715",
                "53889555703544458596860605247743870326",
                "167295998055282435918198225905340355709",
                "317039130943411275819438502804587418224",
                "208232089401901849257744667454295624337",
                "118906997162566598531539434225608172568",
                "269336952215750429481230206750852950816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107836-6d5a9292",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "85576472473844659981495769844718779669",
            "length": 1035
        },
        "id": "CVE-2026-107836-d53280a1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "nanocoap_sock_get_slice"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "86655763879694701067059363373943424872",
                "52983483485435362535563710308056867620",
                "83814966440024713590605234216942936858",
                "176782073988666981597286985393780243225",
                "272476517447821318251507201679314108142",
                "207106696261093784596848394233525082443",
                "261913128923142119564828157008697152867",
                "248008639538615087286692725592895037861",
                "289707576713756604315005171446649257861",
                "72033815380575572653759745585185772079",
                "13931619124233481876713985926503381734",
                "176471574168916367415382125590624165505",
                "21889805689210607826657557803394529488"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107836-e01f07e3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/include/net/nanocoap_sock.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "133940198885908497024920368892225783280",
            "length": 542
        },
        "id": "CVE-2026-107836-ffe08410",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839",
        "target": {
            "file": "sys/net/application_layer/nanocoap/sock.c",
            "function": "_block_cb"
        }
    }
]
vanir_signatures_modified 
"2026-10-11T07:04:31Z"